Get specific values by providing key

[thewho123]

I have a lot of lines in the following format:

CPU: 2.7GHz, 2, 'Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz', OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: 'HP EliteBook Folio 9480m', 'Hewlett-Packard'

I get this list with: "CPU: earliest=-1h"

I am trying to create a dashboard/graph showing statistics on what OS and CPU customers use mostly.

How do I achieve this?

[Runals]

You can use somesoni2's rex statement to pull out the fields but then depending on how you want to present the data you could do a simple stats command

... | dedup host | stats count by CPU OS | sort -count

Based on your query I'm guessing the data is generated every hour? Dedup is good though if the data is generated sporadically and you search over a longer period of time there can be more efficient ways to get the most recent data from each system. This also assumes you are saying "showing statistics on what combination OS and CPU customers use mostly"

A good resource to use for making regular expressions is regex101.

[somesoni2 · Accepted solution]

Try something like this

index=foo sourcetype=bar "CPU:" earliest=-1h | rex "CPU:\s+(?<CPU>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"

[thewho123]

Thanks. One more question: What would I need to add to the rex string to get RAM if I have a log like this:

CPU: 2.5GHz, 2, 'Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz', RAM(total): 7879MB, RAM(free): 3738MB, OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: '20AN0069US', 'LENOVO'

I would be interested in RAM(total) and RAM(free)

[somesoni2]

The regex is created in the same order they appear in the data, so for your sample logs, the rex command will be like this

| rex "CPU:\s+(?<CPU>.+),\s+RAM\(total\):\s+(?<RAM_total>.+),\s+RAM\(free\):\s+(?<RAM_free>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"